cve-2022-23131

cve-2022-23131 FOFA app="ZABBIX-监控系统" && body="saml" Run python cve-2022-23131.py https://www.example.com Admin Use the exp to generate signedsession, replace the cookie, then click Sign in with Single Sign-On SAML Default is Admin Act responsibly, you bear the consequences A chance encounter, a...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...

CVE-2020-15051

CVE-2020-15051 : Artica Proxy before 4.28.030418 Community Edition allows Stored Cross Site Scripting. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000...

CVE-2025-66850

Finding Within the ‘LibreNMS’ application, we discovered a reflected Cross-Site Scripting vulnerability; this vulnerability exists in the routing module’s protocol parameter, allowing an attacker to render malicious JavaScript in a victim’s browser. This vulnerability affects all versions from...

yappy

Yappy 🐶 AI-powered LinkedIn engagement assistant. Automatically discover LinkedIn posts and leave thoughtful, unique, AI-generated comments that actually sound like you. Yappy is a powerful terminal-based tool that uses Google's Gemini AI and Playwright browser automation to help you stay active ...

CVE-2020-26732

CVE-2020-26732 SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session Description SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTP...

DEBIAN-CVE-2026-102944

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2026-102944

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Note: XXS Also works when these URLs are used in Referer Header. The...

CVE-2025-5777

Exploit for CVE-2025-5777: Citrix NetScaler Memory Disclosure CitrixBleed 2 T1606 Disclaimer Intented for authorized use only. It is your responsibility to verify authorization before use. I am not responsible for any legal or criminal proceedings filed against you for using this. Description...

cve-2022-23131

cve-2022-23131 Usage: python3 zabbix.py target Admin target is the target address Admin is fixed as the administrator username Replace the generated zbxsignedsession with the cookie of the current target Click "Sign in with Single Sign-On SAML" on the login page to directly enter the management...

CVE-2023-45542

CVE-2023-45542 A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: q Exploit - Proof of Concept POC Reflect...

adaPwn

adaPwn - CVE-2019-14912 PoC adAS OPENSSO module doesn't correctly verify the domain to redirect, making possible to redirect the user to an attacker controlled website, stealing his adAS session cookie. Usage usage: adaPwn.py -h --interface INTERFACE --httpPort HTTPPORT --dnsPort DNSPORT ipToSpoo...

CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

CVE-2023-43325

mooSocial: XSS CVE-2023-43325 A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter:...

CVE-2019-13633

CVE-2019-13633 Suggested description : Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. Additional Information : Blinger.io - is a platform which used by global clients such as FxPro, Alfa Bank, OneTwoTrip, Ivi, KupiVIP Group, Belavia, Wargaming, Yandex, OZON, TCS Group Holding and...

CVE-2022-51020: Cross-Site Request Forgery (CSRF)

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

PT-2026-110919

Name of the Vulnerable Software and Affected Versions Flower versions prior to 2.2.0 Description Cross-site request forgery occurs because Tornado xsrf cookies are disabled and the OAuth session cookie lacks the SameSite attribute. This allows attackers to trick authenticated users into visiting...